Re: Circumventing Passwordless Authentication functionality

[Georgi Kodinov]

Hi Chris,

The login paths are not designed to protect your password from a person with su.
They are a stepping stone for better password handling for your scripts.
Without login paths typically a script would just encode the user name and the password into it. In clear text. And since it's in the script(s) body there will be no easy way to change that password should the need arise.
This is what login paths are for.

Now, can we make them proper password wallets ?

That depends. IMHO it's all about getting a key securely from someplace. And in a convenient way too.

The choices you have to get the key from are:
1. The user: you ask for it at the console. That's what mysql will do if you don't give it a password.
2. The OS session: you somehow extract it out of the (already authenticated) OS session. Windows is good at that.
3. Trusted third party on the network. You authenticate via some daemon and then reuse that authentication token as in #2.
4. Some hardware device, e.g. a smart card dongle.

From what I read what you're suggesting is #1: ask the user. Well, but mysql can already do that. Just don't store your passwords into the login path and it will ask you.

I understand #4 is less "secure" since this is something you have and thus you may be liable to provide it on request.

We already have tools to do authentication via #2: the socket authentication plugin on unix and the windows authentication plugin on windows (that can also do #3 via active domain).

So if #1 is not good for you I'd suggest you look into that.
Or, alternatively, take a good hard look at why are you using a password for your scripted logins and not some network host restriction etc.

Hope this helps.